Privacy Policy
Last updated: 10 juillet 2026
The French version prevails in case of discrepancy.
ErQuickS ('we'), publisher of the ErQuickS platform, is committed to protecting the privacy of its Users. This Privacy Policy describes what personal data we collect, why, how we use it, with whom we share it and what your rights are.
This Policy is established in accordance with Law No. 2010/012 of 21 December 2010 on cybersecurity and cybercrime in Cameroon (in particular its provisions on personal data protection), CEMAC Regulation No. 02/18/CEMAC/UMAC/CM on payment systems, and international best practices in personal data protection. The National Agency for Information and Communication Technologies (ANTIC) is the competent regulatory authority in Cameroon for cybersecurity and online service matters.
1. Data controller
| Entity | ErQuickS |
| Registered office | Yaoundé, Cameroon |
| DPO — Data Protection Officer | privacy@erquicks.com |
| Regulatory authority | ANTIC — National Agency for Information and Communication Technologies (Cameroun) |
2. Data collected
We collect only data necessary to provide the service, according to the User's profile:
2.1 Data common to all Users
| Data | Purpose | Mandatory |
|---|---|---|
| Phone number (MTN/Orange) | OTP authentication, WhatsApp/SMS notifications, Mobile Money | Yes |
| First name and last name | Personalisation, commercial relationship, identification | Yes |
| Optional notifications, account recovery, transaction receipts | No (optional) | |
| Delivery addresses | Delivery fee calculation, dispatch, driver navigation | Yes (to place orders) |
| FCM token (Firebase Cloud Messaging) | Push notifications (orders, offers, alerts) | No (with prior consent) |
| Device identifier, platform (iOS/Android), device name | Multi-device management, security (remote logout), optimisation | Yes (automatic) |
| Last login IP address | Abnormal access detection, account security, audit logs | Yes (automatic) |
| User-agent (browser/app + version) | Security audit logs, traceability of sensitive actions | Yes (automatic) |
| Social login identifiers (Google, Apple, Facebook) | Social login frozen for v1 (no data collected). May be reintroduced in v2. | No (feature frozen for v1) |
| Security PIN hash + backup email | Account recovery, enhanced security (Merchants & Drivers) | No (optional) |
| Local biometric authentication (Face ID, fingerprint) | Fast app unlock after initial login. Biometric data stays on the device and is never collected by ErQuickS. | No (optional, local only) |
| Application activity logs | Security, fraud prevention, internal audit, debugging | Yes (automatic) |
| Device and operating system (version) | Compatibility, optimisation, debugging | Yes (automatic) |
2.2 Customer-specific data
| Data | Purpose |
|---|---|
| Order history | Contract performance, disputes, analytics |
| Transaction history (orders, Mobile Money payments) | Financial management, Cameroonian accounting and tax legal obligations |
| GPS location (during active delivery only) | Real-time delivery tracking on map (revocable consent) |
| Registered Mobile Money payment methods (MTN/Orange number + label) + Mobile Money number used per order | Payment execution, billing, dispute resolution |
| Gift order data (recipient name, phone number, personalised message) | Gift order routing, user experience |
| Cashback (amount, campaign, expiry date) and loyalty points (earn, spend, expiry) | Loyalty benefits and rewards management, User engagement |
| Coupons and promotional codes used | Discount calculation, abuse control, marketing analytics |
| Photos and GPS snapshot during an order report | Processing of dispute or incident file, evidence of condition at time of report |
| Cart and browsing preferences | User experience, recommendations |
2.3 Merchant and Driver-specific data (KYC)
| Data | Purpose |
|---|---|
| National identity document (CNI / passport) | Legal identity verification (KYC), BEAC/COBAC compliance |
| Liveness verification video selfie | Confirmation that the applicant is physically present and matches the identity document |
| Business document (Merchants only) | Verification of the legality of commercial activity (business licence, trade register) |
| Real-time GPS location (Drivers — foreground and background during active missions) | Mission dispatch, delivery tracking by the customer and operations team, navigation, delivery proof. Background tracking stops when the mission is completed or when location sharing is disabled according to the options available in the app. |
| Additional driver documents (insurance, signed contract, vehicle-related proofs) | Driver onboarding, operational compliance, contract management |
| Vehicle type, registration number (Drivers) | Mission dispatch, security, legal compliance |
| In-app delivery messages (text + media exchanged between Driver and Customer) | Coordination during delivery, evidence in case of dispute |
| Delivery proof photo + GPS coordinates and timestamp at time of delivery | Proof of delivery execution, dispute resolution |
| Revenue and remuneration data | Mobile Money earnings payment, tax declarations, anti-money laundering |
| Personalized commission proposals: rate, period, written justification or private document, administrator identity and Merchant decision | Informing the Merchant, collecting acceptance, applying the agreed rate and ensuring contractual traceability. Private evidence is accessible only to authorized administrators. |
3. Legal bases for processing
- Contract performance: Data necessary to provide the service (orders, Mobile Money payments, deliveries). Primary basis for the majority of processing.
- Consent: Push notifications via FCM (revocable at any time in app settings); Client-side GPS location during delivery; analytical cookies on the showcase site.
- Operational necessity for Drivers: Background location is used only when a Driver is available or engaged in a mission in order to assign, secure and track deliveries in real time.
- Legal obligation: Retention of financial transaction data for Cameroonian accounting and tax obligations (10 years); retention of KYC documents for BEAC/COBAC due diligence obligations.
- Legitimate interest: Fraud prevention and platform security; service improvement; debugging and technical incident management.
4. Data retention period
| Data category | Retention period | Justification |
|---|---|---|
| Active account data | Account activity duration + 30 days after deletion | Contract performance |
| Financial transaction data (Mobile Money payments, commissions) | 10 years | Cameroonian accounting and tax obligation |
| KYC documents (CNI, passport, business document) | 5 years after end of contractual relationship | BEAC/COBAC due diligence obligation (AML-CFT) |
| Security and audit logs | 2 years | Legitimate interest — security / Law 2010/012 |
| Acceptance evidence and personalized commission history | Duration of the contractual relationship, followed by the applicable limitation period | Contract performance and establishment or defence of legal claims |
| GPS location data | 90 days (automatic purge) | Limited purpose — delivery proof only |
| OTP tokens | 10 minutes (automatic expiration) | Security |
| Active sessions | 90 days (or upon logout) | Security and user experience |
| Resolved dispute data | 5 years | Contractual evidence |
5. Data sharing with third parties
We never sell or rent your personal data. We may share it only with the following processors and partners, strictly within the scope of providing the service:
| Partner / Processor | Role | Data transmitted | Location |
|---|---|---|---|
| NotchPay | Mobile Money (MTN MoMo / Orange Money) and bank card (Visa/Mastercard) payment processing. For card payments, the user is redirected to the secure page hosted by NotchPay — ErQuickS does not collect or store any card number, CVV or expiry date. | Mobile Money: phone number + amount. Bank card: only a transaction reference (payment_reference). Payment links: third-party payer data transmitted directly to NotchPay. | Cameroon / CEMAC zone |
| Firebase (Google LLC) | Push notifications (FCM) and real-time GPS tracking (Realtime Database) | FCM token, delivery identifier, GPS coordinates required for real-time tracking | EU / Belgium (Europe region) |
| Google, Apple, Facebook | Social authentication — feature frozen for v1, no data currently transmitted. May be reintroduced in v2. | Social identifier, email address, public name and temporary authentication token depending on the provider (once the feature is reactivated) | International |
| Evolution API | Self-hosted WhatsApp service for authentication OTP delivery | Phone number, OTP message only | Own infrastructure — no data transmitted to third parties |
| Techsoft SMS | SMS OTP delivery as fallback when WhatsApp is unavailable | Phone number, OTP message | Cameroun |
| Cloudflare R2 | Secure storage of product images and encrypted KYC documents | Product images, encrypted KYC documents | Africa / EU (secure global CDN) |
| Sentry | Application error monitoring | Pseudonymised user identifier, technical context, error traces and performance. KYC documents, payment card details and sensitive contents are not intentionally sent to Sentry. | USA (clauses contractuelles types UE) |
| HERE Maps | Route calculation and delivery time estimation | Start and end GPS coordinates | UE |
| Didit (KYC) | Automated identity verification (liveness check) | CNI/passport image, video selfie (processed then deleted) | UE |
| Resend | Transactional email delivery (admins, applications) | Email address, message content | USA (clauses contractuelles types UE) |
6. Your rights
In accordance with the personal data protection principles recognised by Law No. 2010/012 and international best practices, you have the following rights:
- Right of access: Obtain a structured copy of your personal data held by ErQuickS.
- Right of rectification: Have inaccurate, incomplete or outdated data corrected.
- Right to erasure ('right to be forgotten'): Request deletion of your account and personal data (subject to eligibility conditions). See the Data Deletion page.
- Right to portability: Receive your data in a structured, commonly used and machine-readable format (JSON/CSV).
- Right to object: Object to the processing of your data for commercial prospecting or analytical purposes.
- Right to withdraw consent: Revoke your consent to push notifications (in app settings) or GPS location at any time.
- Right to restriction of processing: Request temporary suspension of the processing of your data while verifying a contestation.
To exercise these rights, contact our Data Protection Officer: privacy@erquicks.com
We will process your request within a maximum of 30 days. If you are not satisfied with our response, you may contact ANTIC (National Agency for Information and Communication Technologies) in Cameroon.
7. Data security
We implement the following technical and organisational measures to protect your data:
- HTTPS/TLS 1.3 encryption for all network communications.
- Secure authentication token storage (expo-secure-store on mobile, encrypted storage on server).
- Biometric data is kept exclusively by the device operating system; ErQuickS never receives it.
- Encryption of KYC documents at rest on Cloudflare R2.
- Logging of all sensitive actions (audit logs) with complete traceability.
- Strict role-based access control (RBAC): each team member only accesses data necessary for their function.
- Mandatory two-factor authentication (TOTP 2FA) for all administrators.
- Regular security testing and security-focused code reviews.
- Network segmentation: sensitive data is isolated from public systems.
In the event of a data breach likely to result in a risk to your rights and freedoms, we commit to informing you as soon as possible, in accordance with our legal obligations.
8. International data transfers
Some of our processors (Firebase/Google, Cloudflare, Sentry, HERE Maps, Didit, Resend) may process data outside Cameroon and the CEMAC zone. These transfers are governed by: standard contractual clauses (SCCs) for transfers to the European Union or countries recognised as offering an adequate level of protection; contractual commitments from our partners to respect equivalent data protection standards. We ensure that no sensitive data (KYC documents, detailed financial data) is transferred outside the African continent without enhanced contractual guarantees.
9. Cookies and trackers (showcase site)
Our showcase site (erquicks.com) uses only strictly necessary cookies for its operation (language preference, session preferences) and strictly anonymised analytical cookies (no personal identifier). No advertising or third-party tracking cookies are used. The mobile application does not use cookies; it uses the device's local secure storage.
10. Minors
The ErQuickS Platform is strictly reserved for adults (18 years or older). We do not knowingly collect personal data relating to minors. If you are aware that a minor has created an account, please contact us at privacy@erquicks.com so we can proceed with immediate deletion of that account.
11. Policy modifications
We reserve the right to modify this Policy at any time to reflect legal, regulatory or technical developments. Any substantial modification will be notified via in-app and/or SMS at least 15 days before taking effect. The current version is always accessible at erquicks.com/politique-confidentialite.
12. Contact and complaints
Data Protection Officer (DPO): privacy@erquicks.com
General contact: contact@erquicks.com
ErQuickS — Yaoundé, Cameroon
If you are not satisfied with our response, you may lodge a complaint with ANTIC (National Agency for Information and Communication Technologies, Cameroon) or any other competent supervisory authority.